Connect sign-up to Sendico Facts intake (#46)

2026-10-15 00:55:19 +02:00
1 parent 30f0455122
commit a584c8189a
@@ -0,0 +1,69 @@
+package sendico
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+
+	"git.sendico.io/tech/sxchnge/product/identity"
+	merrors "git.sendico.io/tech/sxchnge/shared/errors"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func (c *Client) post(ctx context.Context, resource, requestRef string, payload any) (receiptDTO, error) {
+	var receipt receiptDTO
+	token, err := c.token()
+	if err != nil {
+		return receipt, err
+	}
+	var body []byte
+	if payload != nil {
+		body, err = json.Marshal(payload)
+		if err != nil {
+			return receipt, merrors.OpaqueWrap(merrors.ErrServiceUnavailable, err, "encode Sendico request")
+		}
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.base+"/"+resource+"/"+c.config.OrganizationID, bytes.NewReader(body))
+	if err != nil {
+		return receipt, merrors.OpaqueWrap(merrors.ErrServiceUnavailable, err, "create Sendico request")
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-Request-ID", requestRef)
+	response, err := c.http.Do(req)
+	if err != nil {
+		return receipt, merrors.OpaqueWrap(merrors.ErrServiceUnavailable, err, "Sendico request failed")
+	}
+	defer func() { _ = response.Body.Close() }()
+	// Never decode or expose upstream error bodies, which can contain assertions.
+	if response.StatusCode != http.StatusOK {
+		return receipt, merrors.ServiceUnavailable("Sendico request was not accepted")
+	}
+	decoder := json.NewDecoder(io.LimitReader(response.Body, 16385))
+	var envelope envelopeDTO
+	if err := decoder.Decode(&envelope); err != nil {
+		return receipt, merrors.OpaqueWrap(merrors.ErrServiceUnavailable, err, "decode Sendico receipt")
+	}
+	var trailing any
+	if decoder.Decode(&trailing) != io.EOF || envelope.Status != "success" {
+		return receipt, merrors.ServiceUnavailable("invalid Sendico response")
+	}
+	return envelope.Data, nil
+}
+
+func (c *Client) Register(ctx context.Context, requestRef string) (string, error) {
+	dto, err := c.post(ctx, "individuals", requestRef, nil)
+	if err != nil {
+		return "", err
+	}
+	return mapSubject(dto)
+}
+func (c *Client) Submit(ctx context.Context, subject, source string, facts identity.Facts) (identity.Receipt, error) {
+	dto, err := c.post(ctx, "identity_facts", bson.NewObjectID().Hex(), mapFacts(subject, source, facts))
+	if err != nil {
+		return identity.Receipt{}, err
+	}
+	return mapReceipt(dto, subject)
+}
@@ -0,0 +1,155 @@
+package sendico
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"git.sendico.io/tech/sxchnge/product/identity"
+	"github.com/stretchr/testify/require"
+)
+
+const org = "507f1f77bcf86cd799439011"
+const source = "507f1f77bcf86cd799439012"
+const subject = "507f1f77bcf86cd799439013"
+const submission = "507f1f77bcf86cd799439014"
+
+func credential(t *testing.T, id string, expiry int64) string {
+	t.Helper()
+	raw, err := json.Marshal(map[string]any{"id": id, "exp": expiry})
+	require.NoError(t, err)
+	return "header." + base64.RawURLEncoding.EncodeToString(raw) + ".signature"
+}
+func config(t *testing.T, endpoint string) Config {
+	t.Helper()
+	file := filepath.Join(t.TempDir(), "token")
+	require.NoError(t, os.WriteFile(file, []byte(credential(t, source, time.Now().Add(time.Hour).Unix())), 0600))
+	return Config{APIURL: endpoint + "/api/v1", OrganizationID: org, SourceID: source, TokenFile: file}
+}
+
+func TestSignupWireContractAndCredentialRotation(t *testing.T) {
+	paths := []string{}
+	var token string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		require.Equal(t, http.MethodPost, r.Method)
+		require.Equal(t, "Bearer "+token, r.Header.Get("Authorization"))
+		paths = append(paths, r.URL.Path)
+		body, err := io.ReadAll(r.Body)
+		require.NoError(t, err)
+		if strings.Contains(r.URL.Path, "/individuals/") {
+			require.Equal(t, "registration-request", r.Header.Get("X-Request-ID"))
+			require.Empty(t, body)
+			_, _ = fmt.Fprintf(w, `{"status":"success","data":{"subject_ref":%q,"registered_at":"2026-10-07T10:30:00.123Z"}}`, subject)
+		} else {
+			require.JSONEq(t, `{"subject_ref":"`+subject+`","source_submission_ref":"signup-1","facts":{"full_name":"Ada Lovelace","email":"ada@example.com","external_customer_ref":"local-user"}}`, string(body))
+			_, _ = fmt.Fprintf(w, `{"status":"success","data":{"subject_ref":%q,"submission_ref":%q,"accepted_at":"2026-10-07T10:30:00.123Z"}}`, subject, submission)
+		}
+	}))
+	defer server.Close()
+	cfg := config(t, server.URL)
+	token = credential(t, source, time.Now().Add(time.Hour).Unix())
+	client, err := Open(cfg)
+	require.NoError(t, err)
+	ref, err := client.Register(context.Background(), "registration-request")
+	require.NoError(t, err)
+	require.Equal(t, subject, ref)
+	// File rotation takes effect without restarting; account identity stays fixed.
+	token = credential(t, source, time.Now().Add(2*time.Hour).Unix())
+	require.NoError(t, os.WriteFile(cfg.TokenFile, []byte(token), 0600))
+	receipt, err := client.Submit(context.Background(), subject, "signup-1", identity.Facts{FullName: "Ada Lovelace", Email: "ada@example.com", CustomerRef: "local-user"})
+	require.NoError(t, err)
+	require.Equal(t, submission, receipt.SubmissionRef)
+	require.Equal(t, subject, receipt.SubjectRef)
+	require.Equal(t, []string{"/api/v1/individuals/" + org, "/api/v1/identity_facts/" + org}, paths)
+	require.NoError(t, os.WriteFile(cfg.TokenFile, []byte(credential(t, org, time.Now().Add(time.Hour).Unix())), 0600))
+	_, err = client.Register(context.Background(), "registration-request")
+	require.Error(t, err)
+	require.Len(t, paths, 2)
+}
+
+func TestRejectInvalidConfiguration(t *testing.T) {
+	for _, endpoint := range []string{"http://remote.example", "https://user:pass@api.example", "https://api.example?secret=x", "https://api.example/#fragment", "//api.example", "ftp://localhost"} {
+		_, err := Open(config(t, endpoint))
+		require.Error(t, err, endpoint)
+	}
+	cfg := config(t, "https://api.example")
+	cfg.OrganizationID = "../other"
+	_, err := Open(cfg)
+	require.Error(t, err)
+	cfg = config(t, "https://api.example")
+	cfg.SourceID = ""
+	_, err = Open(cfg)
+	require.Error(t, err)
+	cfg = config(t, "https://api.example")
+	require.NoError(t, os.WriteFile(cfg.TokenFile, []byte(credential(t, source, 1)), 0600))
+	_, err = Open(cfg)
+	require.Error(t, err)
+}
+
+func TestUpstreamFailuresNeverProduceReceiptsOrLeakBodies(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		status int
+		body   string
+	}{
+		{"denied", 403, `{"secret":"private-assertion"}`},
+		{"conflict", 409, `{"secret":"private-assertion"}`},
+		{"unavailable", 503, `{"secret":"private-assertion"}`},
+		{"malformed", 200, `{"private-assertion":`},
+		{"empty", 200, `{"status":"success","data":{}}`},
+		{"wrong-status", 200, `{"status":"error","data":{}}`},
+		{"oversized", 200, `{"padding":"` + strings.Repeat("x", 17000) + `"}`},
+		{"wrong-subject", 200, `{"status":"success","data":{"subject_ref":"` + org + `","submission_ref":"` + submission + `","accepted_at":"2026-10-07T10:30:00Z"}}`},
+		{"trailing", 200, `{"status":"success","data":{}} {}`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(tc.status)
+				_, _ = io.WriteString(w, tc.body)
+			}))
+			defer server.Close()
+			client, err := Open(config(t, server.URL))
+			require.NoError(t, err)
+			_, err = client.Submit(context.Background(), subject, "key", identity.Facts{})
+			require.Error(t, err)
+			require.NotContains(t, err.Error(), "private-assertion")
+			_, err = client.Register(context.Background(), "registration-request")
+			require.Error(t, err)
+		})
+	}
+}
+
+func TestRedirectAndTimeoutDoNotRepeatRegistration(t *testing.T) {
+	var calls int
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		http.Redirect(w, r, "/redirected", http.StatusTemporaryRedirect)
+	}))
+	defer server.Close()
+	client, err := Open(config(t, server.URL))
+	require.NoError(t, err)
+	_, err = client.Register(context.Background(), "registration-request")
+	require.Error(t, err)
+	require.Equal(t, 1, calls)
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	_, err = client.Register(ctx, "registration-request")
+	require.Error(t, err)
+	require.Equal(t, 1, calls)
+	timeoutServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { <-r.Context().Done() }))
+	defer timeoutServer.Close()
+	client, err = Open(config(t, timeoutServer.URL))
+	require.NoError(t, err)
+	client.http.Timeout = 20 * time.Millisecond
+	_, err = client.Register(context.Background(), "timeout-request")
+	require.Error(t, err)
+}
@@ -0,0 +1,87 @@
+// Package sendico consumes only Sendico's public HTTP contracts.
+package sendico
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"time"
+
+	merrors "git.sendico.io/tech/sxchnge/shared/errors"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+type Config struct {
+	APIURL         string `yaml:"api_url"`
+	OrganizationID string `yaml:"organization_ref"`
+	SourceID       string `yaml:"source_account_ref"`
+	TokenFile      string `yaml:"token_file"`
+}
+
+type Client struct {
+	config    Config
+	base      string
+	namespace string
+	http      *http.Client
+}
+
+func Open(c Config) (*Client, error) {
+	u, err := url.Parse(c.APIURL)
+	if err != nil || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || u.RawPath != "" || (u.Scheme != "https" && !(u.Scheme == "http" && (u.Hostname() == "localhost" || u.Hostname() == "127.0.0.1"))) {
+		return nil, merrors.InvalidArgument("Sendico API URL must be absolute HTTPS (HTTP allowed on localhost)")
+	}
+	for _, ref := range []string{c.OrganizationID, c.SourceID} {
+		id, err := bson.ObjectIDFromHex(ref)
+		if err != nil || id.IsZero() || ref != id.Hex() {
+			return nil, merrors.InvalidArgument("Sendico organization and source references must be lowercase object IDs")
+		}
+	}
+	if strings.TrimSpace(c.TokenFile) == "" {
+		return nil, merrors.InvalidArgument("Sendico token file required")
+	}
+	base := strings.TrimRight(c.APIURL, "/")
+	hash := sha256.Sum256([]byte(base + "\x00" + c.OrganizationID + "\x00" + c.SourceID))
+	client := &Client{config: c, base: base, namespace: hex.EncodeToString(hash[:]), http: &http.Client{Timeout: 4 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}}
+	if _, err := client.token(); err != nil {
+		return nil, err
+	}
+	return client, nil
+}
+
+func (c *Client) Namespace() string { return c.namespace }
+
+// Rotation may replace this file, but must retain the authenticated account.
+// Claim inspection only protects the replay namespace from operator mistakes;
+// Sendico remains responsible for signature validation and authorization.
+func (c *Client) token() (string, error) {
+	raw, err := os.ReadFile(c.config.TokenFile)
+	if err != nil {
+		return "", merrors.OpaqueWrap(merrors.ErrServiceUnavailable, err, "read Sendico credential")
+	}
+	token := strings.TrimSpace(string(raw))
+	parts := strings.Split(token, ".")
+	if len(token) > 16384 || len(parts) != 3 {
+		return "", merrors.FailedPrecondition("invalid Sendico credential")
+	}
+	claims, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return "", merrors.OpaqueWrap(merrors.ErrFailedPrecondition, err, "invalid Sendico credential claims")
+	}
+	var payload struct {
+		ID      string `json:"id"`
+		Pending bool   `json:"pending"`
+		Exp     int64  `json:"exp"`
+	}
+	if err := json.Unmarshal(claims, &payload); err != nil {
+		return "", merrors.OpaqueWrap(merrors.ErrFailedPrecondition, err, "invalid Sendico credential claims")
+	}
+	if payload.ID != c.config.SourceID || payload.Pending || payload.Exp <= time.Now().Unix() {
+		return "", merrors.FailedPrecondition("Sendico credential must be unexpired and match configured source account")
+	}
+	return token, nil
+}
@@ -0,0 +1,51 @@
+package sendico
+
+import (
+	"time"
+
+	"git.sendico.io/tech/sxchnge/product/identity"
+	merrors "git.sendico.io/tech/sxchnge/shared/errors"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// Only consumed wire fields are owned here; never import platform modules.
+type factsDTO struct {
+	FullName    string `json:"full_name"`
+	Email       string `json:"email"`
+	CustomerRef string `json:"external_customer_ref"`
+}
+type submissionDTO struct {
+	SubjectRef string   `json:"subject_ref"`
+	SourceRef  string   `json:"source_submission_ref"`
+	Facts      factsDTO `json:"facts"`
+}
+type receiptDTO struct {
+	SubjectRef    string    `json:"subject_ref"`
+	RegisteredAt  time.Time `json:"registered_at"`
+	SubmissionRef string    `json:"submission_ref"`
+	AcceptedAt    time.Time `json:"accepted_at"`
+}
+type envelopeDTO struct {
+	Status string     `json:"status"`
+	Data   receiptDTO `json:"data"`
+}
+
+func validRef(ref string) bool {
+	id, err := bson.ObjectIDFromHex(ref)
+	return err == nil && !id.IsZero() && id.Hex() == ref
+}
+func mapFacts(subject, source string, facts identity.Facts) submissionDTO {
+	return submissionDTO{SubjectRef: subject, SourceRef: source, Facts: factsDTO{FullName: facts.FullName, Email: facts.Email, CustomerRef: facts.CustomerRef}}
+}
+func mapSubject(dto receiptDTO) (string, error) {
+	if !validRef(dto.SubjectRef) || dto.RegisteredAt.IsZero() {
+		return "", merrors.ServiceUnavailable("invalid Sendico registration receipt")
+	}
+	return dto.SubjectRef, nil
+}
+func mapReceipt(dto receiptDTO, subject string) (identity.Receipt, error) {
+	if !validRef(dto.SubmissionRef) || dto.SubjectRef != subject || dto.AcceptedAt.IsZero() {
+		return identity.Receipt{}, merrors.ServiceUnavailable("invalid Sendico intake receipt")
+	}
+	return identity.Receipt{SubmissionRef: dto.SubmissionRef, SubjectRef: dto.SubjectRef, AcceptedAt: dto.AcceptedAt}, nil
+}